When the user tries to log in, their credentials are sent to you instead of Instagram. One is to use a phishing attack, which is to create a fake login page that looks identical to the real Instagram login page.
How can I protect my Instagram account from malware?.Break into your Instagram account by stealing your cookies.How can I protect my Instagram account from brute force attacks?.Hacking your Instagram account with brute force attacks.How can I protect my Instagram account from phishing attacks?.Hacking an Instagram account by phishing.